Service Life Extension of the ISS Propulsion System 

Elements 


Ulhas Kamath and Gregory Grant " 

The Boeing Company, Houston, TX 77059 

Sergei Kuznetsov^ and Sergey Shaevich * * * § 
Khrunichev Space Center, Moscow 107996 

and 

Victor Spencer** 

NASA Lyndon B. Johnson Space Center, Houston, TX 77058 


The International Space Station (ISS) is a result of international collaboration in building a 
sophisticated laboratory of an unprecedented scale in Low Earth Orbit. After a complex assembly 
sequence spanning over a decade, some of the early modules launched at the beginning of the 
program would reach the end of their certified lives, while the newer modules were just being 
commissioned into operation. To maximize the return on global investments in this one-of-a-kind 
orbiting platform that was initially conceived for a service life until 2016, it is essential for the cutting 
edge research on ISS to continue as long as the station can be sustained safely in orbit. ISS Program 
is assessing individual modules in detail to extend the service life of the ISS to 2024, and possibly to 
2028. Without life extension, Functional Cargo Block (known by its Russian acronym as FGB) and 
the Service Module (SM), two of the early modules on the Russian Segment, would reach the end of 
their certified lives in 2013 and 2015 respectively. Both FGB and SM are critical for the propulsive 
function of the ISS. This paper describes the approach used for the service life extension of the FGB 
propulsion system. Also presented is an overview of the system description along with the process 
adopted for developing the life test plans based on considerations of system failure modes, fault 
tolerance and safety provisions. Tests and analyses performed, important findings and life estimates 
are summarized. Based on the life extension data, FGB propulsion system, in general, is considered 
ready for a service life until 2028. 
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I. Introduction 

T he International Space Station (ISS) is the largest space project to date and the most complex international 
scientific project in history. Built under a joint collaboration of 16 countries, the ISS is the largest international 
peacetime endeavor in human history. With significant accomplishments in the areas of human health, telemedicine, 
education and Earth observations, the ISS has been enhancing the quality of life on Earth, while transforming the 
utilization and exploration of space to become safer and more affordable. In order to maximize the benefits of the 
global investments in the ISS, it is essential to continue experiments on this unique platform by allowing 
opportunities to a large number of researchers to have new theories tested in microgravity, thereby increasing the 
odds of scientific breakthroughs that could benefit the humanity. 

Weighing almost a million pounds, the ISS is about four times as large as the Russian space station Mir and 
about five times as large as the U.S. Skylab. Constructed over a span of more than a decade with the help of over 
100 space flights, elements and modules of the ISS provide more research space than any spacecraft ever built. 
Originally envisaged for a service life of fifteen years, this Earth orbiting laboratory has been in orbit since 1998. 
Some elements that have been launched later in the assembly sequence were not yet built when the first elements 
were placed in orbit. This meant that some of the early modules that were launched at the inception of the program 
would already be at the end of their design life when the ISS was finally ready and operational. 

For instance, Functional Cargo Block (known by its Russian acronym as FGB) and the Service Module (SM), 
which were launched in November 1998 and July 2000, would reach the end of their original certified lives in 2013 
and 2015 respectively. Both FGB and SM are critical for the propulsive function of the ISS. The propulsion system 
operates beginning with the launch of station elements into orbit until the final deorbit; its service life determines the 
service life of the station overall. 

The ISS Propulsion System, managed by the Russian Segment, makes use of Unsymmetrical Dimethylhydrazine 
(UDMH) as fuel and Nitrogen Tetroxide (NTO) as oxidizer. With over six tons of propellant storage capacity, FGB 
serves as a large reservoir of ISS propellants. The Service Module (SM) provides onboard capacity for an additional 
860 kilograms of ISS propellants. In addition, 
visiting vehicles such as the Russian Progress and 
European Automated Transfer Vehicle (ATV) 
replenish the FGB and SM propellants on a regular 
basis. With a fully operational propulsion system, 
equipped with central computers and a network of 
propellant lines, components and thrusters, the SM 
manages the integrated ISS propulsive control. 

After the Service Module was attached to the aft 
docking port of the FGB, the primary responsibility 
of the FGB has been to provide skip cycle 
propellant storage capacity, necessary to allow the 
ISS to remain in orbit for up to one year without 
logistics support from the Earth in the event of 
missed logistics opportunities. 

It is possible to perform ISS attitude and 
altitude maintenance with the help of propellants 
manifested on visiting vehicles, without dipping 
into the onboard reserves. Over 90% of the 
propellants consumed in the last 15+ years of ISS 
existence were supplied by the visiting vehicles 1 . 

However, retaining access to the FGB propellant 
reserve is critical for the success of skip cycle 

survival and a safe deorbit of the ISS. Nominally at 
the end of the ISS life or in an unrecoverable 
contingency, a large amount of propellant, possibly 
in excess of the capacity of the Progress vehicles, would have to be consumed in a short period of time to safely 



Figure 1 FGB in Free Flight 
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Figure 2 FGB Propulsion System 


candidate components based on failure mode effects analysis, 
system level impacts, hazard analysis, etc. An overview of the 
system description and operations along with fault tolerance 
and safety provisions are presented. Tests and analyses 
performed, important findings and expert assessments are 
summarized. Although some of the propulsion system 
elements used in the FGB and SM have common design 
heritage, service life extension of the SM propulsion system 
involves additional considerations required for the continued 
operations of thrusters, avionics, etc. The SM life extension 
efforts will be presented in a separate paper. 


II. FGB Propulsion System 

The FGB (Zarya or “Sunrise”), the first ISS element 
launched, is an enhanced version of previously flown Mir 
science modules, Spektr and Priorda. It was built under a 
contract between Khrunichev Space Center and The Boeing 
Company and was financed by NASA. The FGB incorporates 
two docking interfaces that support propellant transfer, the aft 
docking port and the forward-nadir docking port. At a dry 
mass of approximately 2600 kg, the FGB propulsion system 
consists of an intricate network of propellant tanks, pressurant 
tanks, compressor blocks and two distinct pressurization and 
feed system configurations; one for free flight and another for 
in-orbit operations after SM integration. In free flight, FGB 
relied on two turbopump -fed, regeneratively-cooled 417 kgf 
Main Engines, twenty-four 40 kgf thrusters and sixteen 1.3 kgf 


deorbit the ISS. It would be extremely difficult, if 
not impossible, to ensure a safe and successful 
deorbit of the ISS without utilizing the FGB 
propellants. Taking this into consideration, the ISS 
Program authorized Boeing and Khrunichev to 
begin activities necessary to extend the FGB 
service life until 2028. 

The objective was to evaluate the entire system, 
without testing every single component. Evaluating 
all the components and sub-elements through a 
rigorous test program would be an expensive 
proposition. The type of testing required for 
extending the service life depends on the design 
and criticality of the component, failure modes and 
failure mechanisms, life cycle margin provided by 
the original certification, operational and 

environmental stresses encountered, etc. When 
specific failure mechanism being considered and 
the underlying relationship of that mode to the 
stresses provided in the test can be correlated by 
supporting analysis, time and effort required for 
conducting life extension testing can be 

significantly reduced. 

This paper describes the approach used for the 
service life extension of the FGB propulsion 
system. It outlines some of the techniques used for 
selective testing, by way of cherry picking 



Figure 3 FGB Integrated with Service 
Module 
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thrusters for orbital maneuvers and 3 -axis attitude control 2 . Also prior to SM arrival, FGB Attitude Control System 
(ACS) thrusters were fed by tanks that were controlled with a pres sure -switch based closed-loop pressurization 
scheme. After successful SM integration, the FGB Main Engines were permanently isolated by firing normally open 
pyrotechnic valves in the propellant and pressurant lines. The valves, switches and regulators responsible for the 
closed-loop pressurization of ACS propellant tanks were also isolated by firing the switching pyros, which in effect, 
disabled the software responsible for ACS firing. Latching solenoid valves and ball valves isolating the propellant 
supply to ACS thrusters have remained closed since then. Figure 1 shows FGB in free flight. Permanently isolated 
sections of the FGB propulsion system are denoted as hatched regions in Figure 2. ISS configuration after 
integrating the Service Module with the FGB is shown in Figure 3. 

Control system for the FGB propulsion system consists of two independent sections; one dedicated to thruster 
activations in free flight and the other for pressurant and propellant management for ISS integrated operations. 
Motion Control System (MCS) responsible for thruster control was deactivated upon SM integration and the 
Onboard Computer System (OCS) responsible for propellant supply to and from FGB will remain operational until 
the end of ISS life. 


III. Service Life Extension 

Probability that a component with constant failure rate X will fail at or before time t in the future can be 
expressed as 

F(t) = 1 - Xe~ xt 

Reliability is the probability that the component will survive at least until time t and is given by 

R(t) = Xe~ xt • 2 

A system comprises of many components with varying failure rates. Reliability of a system is the probability that 
it will perform its intended function under encountered operating conditions, for a specified period of time. As we 
are interested in finding out how reliable a system would be in the future, reliability expressed as a function of time 
provides valuable insight. 



Age 


Figure 4 Bathtub Curve of Failure Rate 

However, the component failure rates do not remain constant over the entire cycle life. In a hypothetical bathtub 
shaped failure rate curve shown in Figure 4, the failure rate, defined as the number of failures per unit time that a 
currently healthy component will suffer in a given future time interval, decreases during infant- mortality period, 
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stays nearly constant during the service life and increases at the end when the design service life ends and wear -out 
phase begins 3 . The failure rate depends on various factors such as design complexity, current age of the component, 
operating conditions, severity of environmental stress factors, etc. Development, qualification and acceptance test 
processes provide rigorous screening of components to weed out imperfections that might otherwise cause infant 
mortality failures. 

If sufficient samples are tested to failure, the failure time versus failure quantity can be analyzed statistically to 
develop a failure probability distribution function (PDF), a statistical model of the probability of failure versus time. 
Applying Weibull distributions proposed by Waloddi Weibull in 1937 4 , Defay defines variations in failure rate as a 
function of time 5 



where ft = shape factor of the Weibull PDF, r\ = scale factor of the Weibull PDF and is the time-to- 
breakdown. The parameter /?, also known as Weibull slope varies with time to drive the evolution of failure rate. As 
seen in Figure 4, the failure rate decreases with time when ft < 1, stays constant when /? = 1 and increases with time 
when p>\. 

Driven by cost and schedule constraints, however, spacecraft components are generally not tested in large 
numbers. Uncertainties in failure rate and remaining life estimates increase when fewer units are tested. To account 
for this, spacecraft operators prefer to limit useful operations to a period shorter than the maximum demonstrated 
service life of the weakest component. Running each component to its failure to determine the maximum possible 
service life of a system can become overly expensive and impractical. Spacecraft operators therefore, specify the 
required service life and an acceptable factor of safety (FOS). The designers use these requirements to limit the life 
test duration. Thus, assuming the service life of a spacecraft system begins at time t 1 in Figure 4, life testing the 
components to demonstrate service life of t T would ensure the required FOS when the operational life is limited to t L 
such that 


FOS = 


(Pt ~ tl) 
(Pl — ^l) 


...4 


Midway through the service life span, when benefits justify the additional investment, supplementary life test 
may be performed to demonstrate the capability to safely extend the life to a time t E such that t L <t E < t 2 . 

A. Selective Testing 

An innovative approach was required to ensure continued availability of the FGB propulsion system elements 
beyond their original certification period of fifteen years. Evaluating every component through a brute force test 
program would be a cost prohibitive and time consuming endeavor. FGB propulsion system components were 
designed and built decades ago. There were no representative ground test articles for some of the components. A 
‘test everything’ approach would require manufacturing new test articles. With original manufacturers having gone 
out of business and with rapid changes that have taken place in materials, machines, manufacturing, and operator 
skills, it would be difficult to reproduce representative test articles in many cases. A pragmatic and well thought out 
approach was required to evaluate the entire system, without having to go through an elaborate test program. 

FGB propulsion system consists of over 200 individual components broadly categorized under 30 groups based 
on their varying design, function and complexity. Along with 16 propellant tanks, 16 pressurant tanks and 42 
thrusters, it makes use of 3 functionally redundant compressors, 14 check valves, 9 safety relief valves, 32 
pyrotechnic valves, 7 pressure regulators and over 70 isolation valves of various kind. In addition, parts within some 
of these units may also be critical from a system performance and safety perspective. Depending on their operational 
criticality and safety implications, several components and their parts would possibly require dedicated life 
assessment. 

A comprehensive survey was conducted to identify the components and parts that needed to be subjected to 
detailed investigation. First, a list of all the components used in the FGB propulsion system was generated, by 
categorizing the components as active or inactive. Components in the isolated sections that were no longer in 
service were listed under inactive category. 


5 

American Institute of Aeronautics and Astronautics 



Next, based on engineering judgment, failure modes of all the components, both active and inactive, were 
identified and qualitative rankings were assigned for probability of failure and severity of consequence. Items that 
ranked high on both likelihood of failure and operational/safety impacts were categorized as critical. Items that fell 
under active-critical group were first selected for life assessment. Some items were considered critical, even though 
they were no longer required for ISS operations. For instance, although the FGB Main Engines have been isolated 
and disabled, they were still considered critical since a small amount of propellant locked up between the two closed 
valves in the engine feed system posed a significant safety risk to ISS. 

System level hazard analysis was performed next to identify available fault tolerance against ISS hazards. In this 
bottoms-up analysis, functional redundancy of each component was considered along with the effects of degraded 
performance if the primary hardware suffered a failure. Items providing adequate layers of fault tolerance constitute 
robust design and hence need not be subjected to same rigorous testing as the items lacking multiple levels of 
redundancy. It was recognized that testing selective components providing redundancy mitigates the system level 
risk. So, the components and parts that benefited from the fault tolerance provided by the rest of the system were 
categorized as non-critical. 

The survey produced four categories of components: Active -Critical (AC), Active-Non Critical (AN), Inactive- 
Critical (IC) and Inactive-Non Critical (IN). Barring IN, components in all other categories were selected for further 
investigation. As can be seen in Figure 5, number of potential candidates to be evaluated for service life extension 
was still significant. Embarking on a test program that included component level testing at this stage would still be 
beyond the cost and schedule constraints of this project. Further optimizations were sought to minimize the time and 
expenses without compromising the main objectives. 



•Main Engine 
•Pressure Switches 




•Thrusters 

•Safety valve, Test valves 

•Startup pyrovalve. Shutoff pyrovalve 
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Figure 5 Component Survey and Categorization 


B. Optimization 

When FGB propulsion system was being assembled in the 1990s, components identical to the flight units were 
used to build a ground mockup, known as the D-Unit. Simulating the line dimensions and layouts in the propellant 
and pressurant segments of the flight unit FGB propulsion system, the D-Unit has been in use as a fleet leader on the 
ground. In order to minimize the number of independent test set ups, it was decided to use the D-Unit to apply flow 
and on/off cycles on multiple components simultaneously. Items covered under D-Unit testing included Propellant 
tanks, Safety valve, Solenoid valve, Ball valve unit, Pressure Indicator, Pressure Sensor and Fuel filter. 
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Failure mode analysis, performed as part of the component survey described in Figure 5, was also used to 
identify the life limiting parts within individual components. With no accumulated cycle counts in orbit, efforts to 
extend the service life of components such as relief valves must focus on gradual degradation of material properties 
of soft goods (non metallic seats, seals, etc). Similarly, latching solenoid valves and ball valve assemblies used for 
isolating the FGB thrusters were not required to be certified for additional cycle life but required assessment of 
leakage integrity of their seals. Coupon level testing to characterize the performance of non metallic soft goods 
during accelerated aging in such cases would be the most cost efficient way to extract valuable data. 

Certain components used in the propulsion system integration are designed to provide increased fault tolerance 
both in series and parallel redundant configurations. For instance, pressure regulation of propellant tanks is usually 
accomplished by a series redundant pressure regulator; if the primary regulator fails open, the tank pressure will 
continue to be regulated by the secondary regulator. However, if either primary or secondary regulator fails closed, 
the system loses its pressure regulation function. There are no credible failure-modes that cause a spring loaded 
mechanical regulator to fail closed. Thus, a series redundant pressure regulator is one -fault tolerant. An isolation 
valve in series with such a regulator arrangement provides two -fault tolerance against over-pressurization hazard. 
Safety relief valves provide additional fault tolerance over and above the required two -fault tolerance. 

Parallel redundancy provided by replicating the series arrangement of isolation valve with pressure regulators 
and the safety relief valve, ensures necessary fault tolerance against loss of pressurization resulting from a closed 
failure of an isolation valve. 

Even though they were categorized as AN, necessary fault tolerance provided by series -parallel redundant 
pressure regulators and electro-hydraulic/pneumatic valves meant that these units were not required to be included 
for a full up life extension testing. Similarly, benefiting from the three-for-one redundancy in compressor blocks, all 
the sub components and parts of the compressor system and the check valves in the pressurization system were 
treated as AN. Pressurant tanks were also categorized likewise, taking credit for the configuration featuring sixteen 
high pressure nitrogen bottles arranged in two functionally redundant, inter-connectable sections. All the AN 
elements were either assessed analytically or identified for life assessment by accelerated aging of representative 
soft goods. 

C. Accelerated Life Testing (ALT) 

The type of testing required for extending the service life depends on the design and criticality of the component, 
failure modes and failure mechanisms, life cycle margin provided by the original certification, operational and 
environmental stresses encountered, etc. When specific failure mechanism being considered and the underlying 
relationship of that mode to the stresses provided in the test can be correlated by supporting analysis, time and effort 
required for conducting life extension testing can be significantly reduced. 

Exposure to corrosive propellants over long periods of time, for instance, lead to specific failure mechanisms in 
several components used in the propulsion system. Using Arrhenius model, which is tied to chemically dependent 
failure mechanisms such as corrosion or chemical reactions, it is possible to subject carefully selected test articles to 
ALT. Arrhenius model reflects the proportional relationship between time to failure of a component and the 
exponential of the inverse of absolute temperature acting on the component. To characterize the long term 
survivability of a component exposed to propellants at an average operating temperature of T L , an acceleration factor 
a derived from Arrhenius model can be applied. 

t T r_L__Li 
a = — oc e [T r t l\ 

h - 5 

where t T and t L are durations of accelerated test and intended service life respectively. T t and T L are the average 
temperatures in Kelvin to which the test article and the flight unit in service are exposed. 

The acceleration factor is used to perform tests at higher stresses that allow direct correlation between the times 
to failure at a high test temperature to the temperatures to be expected in actual use. As long as the temperatures are 
such that new failure mechanisms are not introduced, this becomes a very useful method for testing to failure a 
relatively small sample of items for a much shorter amount of time 6 . 


IV. Test and Analysis 

This section provides an overview of various tests and analyses performed, some sample results and conclusions 
drawn for the assessment of service life extension of the FGB Propulsion System. 
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A. Main Engine 

FGB is equipped with two Main Engines (also known as Correction and Docking Engines or CDEs). These 
turbo-pump fed, regeneratively cooled CDEs were used during the free flight period of the FGB for orbit insertion 
and large orbital translations. Designed to operate at a nominal inlet pressure of 5-6 kgf/cm 2 (0.5 - 0.6 MPa) to 
generate a thrust of 417 kgf +16 kgf (4089 N + 157 N) at a chamber pressure of 41 kgf/cm 2 (-4.1 MPa), the CDE 
uses a pneumatic control system to activate the engine valves and to purge lines and turbopump cavities. The CDEs 
were qualified for 100 restarts and 3 years of on-orbit use. Two years after the FGB was launched, the CDEs were 
deactivated by permanently closing the normally open pyrovalves to isolate the propellant supply. Approximately 
3.5 liter (3.5 x 10' 3 m 3 ) each of UDMH and N 2 0 4 at a pressure of up to 5 kgf/cm 2 (-0.5 MPa) remained trapped in 
the line segments between the pyrovalves and the turbopump inlet valves. The trapped propellants could not be 
vented from the main engine. The main engine operates nominally at a mixture ratio of 1.85 + 5%. Operating the 
main engine outside of this range can lead to hazardous consequences including explosion. The venting operation 
can be performed only by sending a firing command to the main engine, which would open both the fuel and 
oxidizer valves simultaneously. This would result in mixing of the two propellants at an indeterminate mixture ratio 
which could lie outside of the nominal range. Two pyrotechnically actuated flow path switching valves were fired 
approximately a year later to permanently vent the main engine pneumatic control system to space, thereby 
precluding any further main engine operation. The FGB CDE inlet lines have been continuously exposed to 
propellants since about 1995. Effects of trapped propellants were characterized for the design service life until 2013. 
Additional testing was required to extend this certification. 

Test Article 

Thruster #38 M, which was manufactured and test fired in 1986, was stored for 24 years in a heated warehouse. 
The unit was inspected, leak checked and readied for the life extension test. 



Figure 6 Main Engine Test Setup 


Accelerated Corrosion Test (ACT) 

The oxidizer line of main engine test article was evacuated and then filled with N 2 0 4 and pressurized to 3 
kgf/cm 2 . (-0.3 MPa) Any propellant stored for longer periods of time typically exhibits deteriorated purity levels and 
therefore has to be purified before using for flight or ground test. The impurities present in the propellants trapped in 
FGB main engine maybe significantly different from the contaminant levels in N 2 0 4 sample used for the aging test. 
To address this concern, N 2 0 4 was drawn directly from the storage tank without purifying further to simulate the 
worst case conditions. 

As shown in Figure 6, the engine was mounted in a thermal chamber and maintained at 50 °C (323 K) for 225 
days of ACT. The methodology utilizes an Arrhenius law approach, where the natural log of a reaction rate is 
proportional to inverse absolute temperature. By this method, for activation energies consistent with chemical 
reactions unaffected by diffusional limitations, increasing the temperature by 10°C will accelerate a chemical 
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reaction rate by approximately two fold. If diffusion limitations exist, acceleration factor for thermal aging will be 
much reduced, and can be as low as 1.1 times per 10 °C increase in temperature. 

Temperature control devices, instrumentation and measurement systems were mounted and calibrated on the 
thermal chamber. During the test, power feed was provided continuously for the gas analysis system (Drager 
Polytron 7000), the instrumentation and thermal control systems. The main engine was instrumented to measure the 
line pressure. At the end of 225 days of ACT, the main engine was leak tested using a gas analyzer (helium mass 
spectrometer). Propellant composition was monitored before and after the ACT. Following the leak check, the test 
article was sectioned to perform corrosion assessment of welds and parent material. 

Figure 7 shows a sample view of the engine parts examined for defect analysis after the accelerated corrosion 
test. All the test results including the defect analysis, propellant composition test and the integrity of inlet and startup 
valves were nominal. 



Figure 7 Defect Analysis 


B. Propellant Tank 

The FGB has 16 propellant tanks, 8 long tanks (3.528 m length, 0.48 m diameter, 88 kg dry mass), and 8 short 
tanks (2.923 m length, 0.48 m diameter, 75.6 kg dry mass). The FGB propellant tank provides propellant expulsion 
by utilizing a stainless steel bellows attached to a rigid hemispherical diaphragm. The rigid diaphragm incorporates 
12 Teflon rollers to guide the bellows during cycle movement. The bellows construction includes a seam welded 
tube formed into a short bellows (~6 folds) and circumferential welded convolutes (~40 folds and 0.8 mm wall 
thickness). All welds are x-rayed. The bellows is approximately 2.4 m long when expanded and 0.5 m long when 
compressed. 

Service life extension of a propellant tank required assessment of several aspects related to the construction and 
long term operation of the tank assembly. The bellows within each propellant tank was originally certified for 30 full 
cycles. When filling from 228 to 407 liters (0.228 to 0.407 m 3 ) and draining from 88 to 0 liters (0.088 to 0 m 3 ), the 
bellows material is subjected to the highest elastic deformations. When the bellows expands from 88 to 228 liters 
(0.088 to 0.228 m 3 ), the bellows undergoes negligible elastic deformation. One half-cycle can be defined as having 
been consumed each time the tank quantity either rises above or falls below a specifically determined tank level. For 
the long tanks, EB/jr/O and EFl/jr/O 1-3, this level is 200 liters (0.2 m 3 ). For the short tanks, TBT/0 1-4, this level 
is 150 liters (0.15 m 3 ). 

Pre-launch qualification of FGB propellant tanks involved 45 bellows cycles to include a safety factor of 1.5. As 
shown in Table 1, additional 66 cycles (42 + 24) were considered necessary to extend the service life certification 
until 2028. 

Another concern in extending the service life of the propellant tank was related to the life of sensors within the 
tanks. Each tank consists of three Bellows Position Indicators (BPI) at the top of the tank, which are activated when 
the tank is full. Additionally, the propellant tank uses a bellows sensor, called a linear translation transducer (LTT) 
to gage propellant in the tank. The sensor measures bellows position with the help of a cable attached to the rigid 
hemispherical diaphragm and a shaft at the top of the tank. As the propellant is consumed, the bellows collapses 
toward the bottom pulling the cable with it. The bellows/rigid diaphragm position can be calculated by using a 
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potentiometer to determine the length of the cable between the rigid diaphragm and the shaft. Applying required 
number of full cycles on representative tanks would address the cycle life issues for bellows as well as the sensors. 

Table 1 Bellows Cycles 


Start of 
Operating 
Period 

End of 
Operating 
Period 

Number 
of Years 

Expected 
Cycles 
per year 

Expected 

Cycles 

over 

period 

Safety 

Factor 

Test 

Cycles 

Applied 

1998 

2013 

15 

2 

30 

1.5 

45 

2013 

2020 

7 

4 

28 

1.5 

42 

2020 

2028 

8 

2 

16 

1.5 

24 

Cumulative 

30 


74 

1.5 

111 


An additional concern related to propellant tank recertification was that the cable/potentiometer device is 
guaranteed to work only if propellant vapor concentration in the tank ullage is <0.005 mg/liter (< 5 mg/m 3 ). Higher 
concentrations may cause intense corrosion both in the gage and other tank parts (like bearings, guides, cable, etc.). 
To address this risk, it was decided to apply additional 111 cycles on four sensor assemblies while subjecting them 
to accelerated corrosion testing. 

Structural integrity of the propellant tank is another critical aspect to be addressed for extending its service life. 
The tank shell is made of an aluminum-magnesium alloy and the bellows and rigid diaphragm are made of stainless 
steel. A bimetallic weld joint is used to attach the bellows to the tank shell. The tank shell for the high pressure tanks 
is -2.5 mm thick and is ~1.5 mm thick for the low pressure tanks. It was decided to perform a structural analysis to 
ascertain the structural integrity of the propellant tanks. 


Assessment for Propellant Tank Assembly 


Sensor Bt-710 





Figure 8 Propellant Tank Test Setup for Bellows Cycling (left) and Wet Vibration (right) 
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Two short and two long propellant tanks were selected for carrying out bellows cycle life extension tests. They 
included two tanks from the D-Unit (described in a later Section), one standalone short tank and another tank 
removed from FGB-2. FGB-2 was built as a backup for ISS FGB (also known as FGB-1). D-Unit tanks were 
subjected to bellows cycle life testing as described above. 

Figure 8 shows examples of test arrangements used for the propellant tank. Visual inspection, pressure check, 
leak check and sensor performance verification were performed at various stages of the sequence on the standalone 
tank. The tank was subjected to incoming inspection, transportation vibration testing on a truck, thermal cycling, 

The tank with its bellows and sensors withstood all 
the tests and met their performance specifications. All 
three Bellows Position Indicators (designated #213, 
#214 and #215) were removed from the tank for further 
assessment. BPI #213 underwent an additional 90 
actuations at 27 V and 0.25 A by applying a cyclic load 
on the connector rod that actuates the limit switch. All 
three BPI units #213, #214 and #215 were dismantled 
and subjected to defect analysis. As seen in Figure 9, 
the piece parts were found nominal without any chips, 
scuff marks or scratches. 

Accelerated Corrosion Test (ACT) was performed 
on the LTT. In the case of the main engine, the test was 
performed on a line segment filled with liquid 
propellant (100% concentration). Elevated temperature 
of 50°C (323 K) was applied over 225 days to 
complete the accelerated aging test. In the case of LTT, 
by increasing the propellant concentration by 10 fold, 
the test duration was reduced further. 

Original specification for allowable propellant 
concentration of 5 mg/m 3 was derived by the designers 
based on their 1970’s research on bellows technology. 
This allows for sensor operation in spite of the worst case molecular diffusion of propellants that could take place 
through the thin membrane of stainless steel bellows. Original design specification required LTT to withstand 
exposure to 5 mg/m 3 of propellant vapors for 15 years. Prior to FGB launch, accelerated aging test was performed to 
demonstrate this capability. Even though it is considered unlikely to have maximum concentration over the entire 
service life, current assessment is performed for the worst case. So far, there is no indication from available 
telemetry to suggest degraded performance of the sensor. Taking all available data including the life test assessment 
into account, it was concluded that there is no reason to increase the maximum concentration beyond the original 
specification of 5 mg/m 3 for 30 years operation. 

A total of 6 sensors were placed inside two sealed test chambers. Two units (#504 and #509) were mounted in 
the fuel (UDMH) chamber and the remaining four units (#635, #869, #1252 and #1253) in the oxidizer (N 2 0 4 ) 
chamber. Both UDMH and two of the N 2 0 4 sensors (#635 and #869) were from long tanks (measurement range 0- 
2800 mm) and the others were from short tanks (measurement range 0-1250 mm). All sensor units were 
manufactured to original FGB specifications and were cycled to 1 1 1 cycles prior to the aging test. 

The purpose of the ACT was to assess the performance of LTT assuming the worst case exposure to propellant 
vapors for 30 years (from 1998 to 2028). The test chambers were filled with a mixture of nitrogen gas and propellant 
vapors at a propellant concentration of 50 mg/m 3 , absolute pressure of 110 kPa (0.11 MPa), relative humidity of 
65%, and temperature of 50°C (323 K) for the duration of the test. Flight like mounting arrangement and sensor 
operation were not simulated. 

Test articles were removed intermittently from the chamber, decontaminated and inspected at discreet intervals 
representing 4 year increments starting from the year 2020. Cable movement data was recorded along with 
qualitative observations of discoloration and changes in sound during cable movement. Electrical parameters were 
monitored, but no changes were observed. Cable extension/retraction was performed manually, by taking care to 
simulate in-orbit conditions of linear motion, without imparting lateral forces. 

All parameters were nominal (with some discoloration, as expected) after 89 days of aging test, representing 26 
years of service life. However, three of the four oxidizer units (#869, #1252 and #1253) failed after 105 days (30 
years of life). The spring loaded sensor cable on the failed units extended nominally during the test but failed to 
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vibration, shock test, cycle life test and defect analysis 



Figure 9 Defect Analysis of Bellows Position Indicator 


retract completely and got stuck at 210 mm, 120 mm and 125 mm respectively. Change in sound was noticeable 
during the cable movement and these cables had excessive discoloration. The fourth unit did not get stuck, but had 
undergone discoloration and altered sound pattern, indicating that it could be on the verge of failure. Two of the 
failed units were new and the other had taken part in the bellows cycle life test, indicating that shelf life had no 
effect on the test results. The lubricant on the cable drum of all three sensors had turned into a gummy substance, 
likely from a reaction between the lubricant material and N 2 0 4 vapor. The final cable tension force, change in output 
signals, and final output resistance were not checked, calibration specifications were not collected, and the primary 
error of each measuring channel was not determined, because these parameters require cable displacement over the 
measuring range. Efforts to derive a correlation between propellant concentration and sensor parameters were not 
successful. Since the sensors stayed static within the test chamber, there is no data to verify whether the degradation 
could have been less severe, if the cable movement was simulated to represent in-orbit conditions. The static 
condition simulates the worst case. 

The test data suggests that the sensors may work nominally until 2024, but there is a risk of sensor cable getting 
stuck after this point. After 2024, FGB will be able to supply propellants nominally to SM and Progress. However, 
refueling of FGB tanks may not be possible. 

In addition to a slew of tests performed on the propellant tank assembly, structural integrity of the propellant 
tank was analyzed by determining its crack growth resistance. For this analysis, updated finite element models 
(FEM) of the FGB propellant tank were developed, the stress-strain state of structures subjected to internal pressure 
was calculated, and structural crack growth resistance was analyzed according to NASGRO software Version 6.10. 
The details of this analysis will be presented in a separate paper. 



Figure 10 Stress intensity (Pa) on the external surface of the 
Propellant Tank at 26.5 atm 



Figure 11 Internal surface stress according to Von 
Mises (Pa) for Pressurant Tank at 200 atm 


C. Pressurant Tank 

Nitrogen gas, used as pressurant in the FGB propulsion system is stored in 16 high pressure tanks, arranged in 
two inter-connectable sections. The nitrogen tanks are 38 liter spherical tanks made of titanium (5.5 mm wall 
thickness). All of the pressurant lines are made of stainless steel. Bimetallic weld joints are used to attach the tanks 
to the stainless steel feed lines. FGB was launched at a maximum ground fill pressure of 200 kgf/cm 2 in its 
pressurant tanks. After propulsion system activation, the pressure dropped to approximately 160 kgf/cm 2 , ensuring 
that the tank maximum design pressure (MDP) of 200 kgf/cm 2 is not exceeded even at the worst case temperature of 
50°C. 

Although categorized as an ‘Active-Critical’ component (Figure 5), the pressurant tank was not subjected to a 
dedicated life extension test but was assessed for structural integrity using FEM analysis (Figure 11), which will be 
discussed more in detail in a separate paper. 

Additionally, a nitrogen tank in the D-unit was used for pressurizing the propellant tank during bellows cycle life 
test. A total of 32 cycles of compressor usage was applied on the pressurant tanks, which was sufficient to perform 
all required bellows expansion/compression cycles in the D-Unit propellant tanks towards service life extension. 
Details on testing performed with the D-Unit components are discussed next. 
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D. Testing on the D-Unit 

The D-Unit was used to optimize the test program by performing an integrated test on several components listed 
in Table 2. 


Table 2 Test Articles on the D-Unit 


# 

Component 

Number of 
units tested 

1 

Safety valve 

1 

2 

Pressure indicator 

1 

3 

Pressure indicator 

1 

4 

Solenoid valve 

2 

5 

Ball valve unit 

1 

6 

Propellant tank 

2 

7 

Propellant filter 

1 


In addition to the components listed here, a total of 16 pressure sensors and pressure indicators were removed 
from the D-unit and were sent to the manufacturers for accelerated aging test. The D-unit line segments from which 
these units had been removed were end capped and leak tested. Figures 12 and 13 show the test arrangements used 
for D-Unit components. 



Figure 12 D-Unit Test Stand 



1 - ball valve unit 11 <£77-6124-0; 2 -measuring device: 3 - pipe d y =6mm; 
4 - inlet fitting; 5 -vent fitting 1 1<£77-6124-4; 6 -outlet fitting 



' Inlet 


1 - safety valve 7 7KM-63 1 2-0; 2 - pipe d y = 6 mm; 3 - measuring device; 4 - inlet 
fitting; 5 - outlet fitting 


Figure 13 Leak Test Setup 


Three bellows position indicators and one linear translation transducer were removed from one of the D-unit 
propellant tanks (separate from the 4 tanks identified for bellows cycle life testing described earlier) and were sent to 
the vendor for life extension testing. Required number of cycles was applied on Pressure sensor, pressure indicator, 
Nitrogen tank, Safety valve, Magnetic impulse valve and the Ball valve unit. 

Pressure indicators (pressure switches) were tested for their actuation pressures over 32 pressure cycles. Set 
pressure in the pneumatic system lines was raised to 40 kgf/cm 2 (~4 MPa) and then decreased until the indicators 
actuated. Along with the 32 cycles on the pressurant tank, the safety relief valves were actuated 16 times by 
pressurizing the pneumatic section of the D-Unit to 27.5 kgf/cm 2 (-2.75 MPa). The propellant tanks remained 
unconnected during the tests and the bellows were not affected by the pressure release from the safety valves. The 
position of the bellows was verified to confirm that the shutoff valves were not leaking during the release of 
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pneumatic pressure. A performance deviation was observed in the safety valve opening pressure. The valve opened 
at 26 kgf/cm 2 (-2.6 MPa), instead of its specification level of 27 kgf/cm 2 (-2,7 MPa). The deviation was considered 
minor and was not expected to impact the functionality. 

The solenoid and ball valve units were subjected to 32 on/off cycles. De -mineralized water was used to simulate 
propellant flow to and from the propellant tanks and the filter unit. Approximately 335 liters (0.335 m 3 ) of water was 
allowed to flow from one tank to the other per cycle. Each cycle represented an expansion/compression cycle of the 
bellows during propellant transfer to/from the FGB tanks. These cycles also simulated propellant flow across the 
filter unit in forward/reverse directions. In their role as fleet leader components, the D-unit tanks had already 
accumulated 28 cycles. Remaining 83 cycles were applied to accumulate a total of 111 cycles required (per Table 2) 
for the service life extension until 2028. Figure 14 shows examples of bellows cycles applied on the D-Unit tanks. 
Functional verification and leak test following the cycle life test yielded nominal results for all the components. 



Figure 14 Change in propellant tank volume with bellows starting at the bottom (left) and the top (right) 


The ball valve unit, the safety valve and the filter were removed from the D-Unit and subjected to accelerated 
aging by heating to and maintaining at 343 K for 7 days at a time for 8 times. After each 7 day hold period in the 
thermal chamber, the units were checked for leaks, specifically between the ball valve’s outlet shaft and rubber fi- 
rings, at the seal between the ball and insert, between the safety valve seat and insert and in the propellant filter 
housing. All the units showed nominal performance. Defect analysis at the end of the accelerated aging revealed no 
defects. 

E. Compressor 

The FGB propulsion system compressor unit is designed to transfer nitrogen from propulsion system propellant 
tank gas volumes into high pressure pressurant tanks. The compressor unit is designed as a leak-tight container that 
houses three compressors, gas distribution equipment (valves, pressure reducers, calibrated orifices, etc.), and a gas- 

liquid heat exchanger. Nitrogen gas at 0.65 to 1.3 
kgf/cm 2 (0.065 to 0.13 MPa) within the container 
helps the convective thermal control of the pneumatic 
supply units during operation. Fans in the pneumatic 
supply unit circulate gas through the gas -liquid heat 
exchanger, which is connected to the thermal control 
system of the FGB. 

The compressor unit is located outside the 

habitation area, on the FGB exterior, and for this 

reason is not subject to routine inspection and repair 

by the crew during on-orbit operation. This 

circumstance required the development of a highly 

ry a j reliable pneumatic/hydraulic schematic for the 

Figure 15 FGB Compressor Assembly under , ; 

compressor unit, which consists of three independent 

MMOD Shielding loops that, in turn, consist of identical components. 
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Each loop is capable of performing a given function, successively transferring pressurization system nitrogen from 
propulsion system propellant tanks to high pressure tanks. Since the compressor unit pneumatic supply devices 
reliably operate at atmospheric pressure, they are located in a pressure -tight container in which a positive pressure is 
maintained. 

Each compressor unit loop is composed of two primary lines: a suction line for nitrogen gas from propulsion 
system propellant unit ullage, and a gas discharge line to propulsion system high-pressure tanks. The functional 
components of each suction line are: a pressure reducer, a safety valve, a pressure indicator, and two fine-mesh gas 
filters, one of which is installed at the line inlet; the other, at the inlet to the pneumatic supply unit. The gas 
discharge line is equipped with two check valves installed sequentially. The gas pressure in the compressor loop is 
recorded by a telemetry pressure sensor. The principal element of the compressor unit pneumatic/hydraulic circuit is 
the pneumatic supply unit which is a single unit that contains a diaphragm-type two-stage compressor with a 
hydraulic drive, a receiver, and fans. 

The metal diaphragms, rigidly fixed in a housing, oscillate between two plate surfaces that limit their motion in 
response to the pressure exerted by the working fluid. The fluid pressure is created by the reciprocal motion of the 
pistons driven by an electric motor through a single-stage planetary reducing gear unit. As the piston moves to top 
dead center, nitrogen gas is drawn into the volume enclosed by the diaphragm of the compressor's first stage. As the 
piston reverses direction, the diaphragm flexes in response to the pressure from the working liquid, compressing the 
gas and injecting it into the compressor's second stage. A similar cycle of operation occurs in the compressor's 
second stage. The nitrogen gas pressure in the compressor's first stage increases from 1 to 30 kgf/cm 2 (0.1 to 3 
MPa); and from 30 to 250 kgf/cm 2 (3 to 25 MPa) in the second stage. 

During the FGB flight, in orbit 18924 on 14 March 2002, one of the three compressors had failed to start. 
Ground testing had shown that a compressor might need a longer start pulse, if its piston gets positioned at its dead 
point. Troubleshooting performed in July of 2002 revealed that the compressor operates as expected until the 
pressure in the high pressure nitrogen tanks reaches 102 kgf/cm 2 (~10.2 MPa). The compressor capacity drops 
significantly at higher pressures, which implies that the likely cause is a failure of one of the check valves in the 
compressor unit. FGB operations continue nominally on the remaining two healthy compressors. As the compressor 
is categorized under ‘Active -Non Critical’ elements (Figure 5), no further assessments were considered necessary to 
ensure guaranteed performance of all compressors, meeting their maximum discharge pressure specifications. The 
following section highlights some of the tasks performed to extend the service life of the compressor unit. 

Compressor Unit Test and Analysis 

Standalone testing of the compressor unit consisted of a 
complete physical simulation of all compressor unit operating 
conditions except zero gravity. Work was carried out on an actual 
compressor unit, manufactured according to the same design 
specifications as the compressor unit flight article. Gas operating 
media at flight like temperatures and pressures were used during 
tests, with a 100% hold of all time and electrical parameters. 

Integrated testing of the compressor unit was carried out on the 
integrated electrical test stand of the Mir orbital station. The 
compressor unit operated for 15 years on Mir as part of the flight 
article, fully supporting the propellant transfer operations of the 
integrated propulsion system. 

During the manufacturing stage of compressor unit 
pneumatic/hydraulic system assemblies, standalone testing was 
performed, including using up their service lives for number of 
actuations. Analysis of the standalone test data showed that the 
scope of testing greatly exceeded the life requirement. All 
compressor unit assemblies and units are located under thermal 
insulation, and operating temperatures in the compressor unit 
installation area do not exceed the temperature limits of -10°C to 
30°C (263 K to 303 K) over 90% of the time. Also, as of this 
writing, the pneumatic supply devices within the FGB compressor 
units have accumulated less than 22% of their certified operational 
lives. Projected usage until 2028 does not exceed the current 
certification levels. No additional cycle life extension tests were 
considered necessary to confirm functionality until 2028. 
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Critical elements within the compressor unit were analyzed for assessing the constraints, if any, on their 
operating lives. The operating life of the gas -liquid heat exchanger is constrained by the duration it is in contact with 
the Triol coolant. Accelerated aging test was performed with FGB thermal control system metals exposed to 
coolants polymethyl siloxane I1MC-I.5p and Triol, to confirm nominal operation of the heat exchanger unit until 
2028. 

Accelerated aging test on rubber seals was performed at elevated temperature to verify the extended life 
capabilities of pressure reducers, check valves, safety valves, two-position electro-pneumatic valve, and the safety 
valve. Analysis performed on various rubber types confirmed that the seals would retain their functionality until 
2028. 

During nominal compressor operation, the operating medium is high-purity nitrogen with a dew point not 
exceeding -65°C (208 K), filtered to a purity finer than 5 pm. No propellant vapors may be present in the nitrogen, 
which is assured by the schematics and design of the propulsion system. It is only possible for propellant vapors to 
mix with nitrogen in the event of a bellows leak in the propellant tank, which is an off-nominal situation. 

The propellant vapor concentration level at which the compressor unit retains its functionality without constraint 
on operating time was not included in the life extension assessment, since the failure mode (bellows leak) which 
would introduce propellant vapors was already addressed by the propellant tank assessment. 

However, some work to determine the propellant vapor concentration at which the compressor performance 
degrades was performed in the year 2000. A mixture of nitrogen and propellant vapors was supplied to the 
compressor unit inlet line on test stand 3Y500; the mixture was allowed to be in contact with all line components: 
PI, C/l, HI, nPKl, ,d,KHl, AKBl, KOI, K06, and the pipelines. It was observed that the compressor performance 
did not degrade after exposure to propellant concentrations ranging from 0.074 mg/m 3 to 3.84 mg/m 3 for 1-3 hours 
at a time over a test campaign of 20 day period. 

Exposure to specification maximum limit of 5 mg/m 3 of propellant vapor over 26-30 years is a concern that was 
studied as part of the propellant tank assessment. Causes leading to such failure modes are not considered to affect 
the compressor performance. A concentration of 5 mg/m 3 in a propellant tank will result in a much smaller value 
distributed across the nitrogen section of FGB. Therefore, no changes were recommended with respect to the 
compressor operating procedures. 

F. Soft Goods 

Several of the ‘Active-Non Critical’ elements identified in Figure 5 were subjected to life assessment by 
accelerated aging of representative soft goods. Rubber seals and O-rings were characterized in their non-deformed 
and deformed states during storage and operational conditions. Test conditions were derived from computer 
algorithms predicting operational endurance of elastomeric materials and design lives of rubber components based 
on a set of mathematical, statistical and probabilistic models. Representative test coupons were placed in a thermal 
chamber at 70 °C (343 K) for 30 days. Clamps were used during aging of rubber samples in a deformed state. 
Measurements were taken on days 3, 7, 14, 21, and 30. In the final stage of testing, the contact stress relaxation was 
determined using the axial compression relaxation instrument. Elevated pressure test took place in special 
containers. Relative residual compression deformation, stress relaxation, static/equilibrium compression modulus, 
sealing capability, and strength/relative strain upon failure were recorded. Isoprene-based rubber samples were 
additionally tested by indentation. 

The results demonstrated a sufficient retention of the yield/elasticity properties of the material, constant elastic 
modulus, and a decreasing relaxation constant. Analysis of the test data confirmed feasibility of extending the 
service life of rubber sealing components by 23 years (overall guaranteed storage and operational life of 25 years, 
and storage and operational life in constituent assemblies of 24 years). For rubber sealing components (rubber/ metal 
valves) made of rubber 51-1448, it is feasible to increase the operational life to 25 years at an operating temperature 
range of -10°C to 30°C (263 K to 303 K) and to 20 years at -10°C to 50°C (263 K to 323 K). With exposure to 
elevated nitrogen pressures (with a pressure drop from 22.5 to 9.0 MPa), the operational life is set at 23 years, with 
an overall guaranteed storage and operational life of 25 years, only for dual rubber/metal valves operating 
consecutively (redundant for failure of valves operating at maximum pressure). 
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Figure 17 Soft Goods Testing 

Fluoro-plastic sealing components in the fittings and assemblies of FGB propulsion system valves were also 
assessed using similar methods. Two types of Fluoroplast-4 coupons underwent accelerated thermal aging testing: 
Pre and post aging strain and strength properties were determined by using a hydraulic press before and after 
subjecting 80 x 5 x 2 mm scoop-shaped strips to accelerated aging tests in a thermal chamber. For the accelerated 
thermal aging of polymer samples, a heat chamber was used with a maximum allowable error of +2° C and a 
maximum allowable operating temperature differential of +2 °C. Analysis of the test data confirmed feasibility of 
extending the service life of all sealing components by 23 years (overall guaranteed storage and operational life of 
25 years). 


V. Conclusions 

As part of the overarching goal to extend the service life of the ISS, systematic assessments have been performed 
for all the critical elements across multiple subsystems spread over different modules built by the U.S. and various 
international partners. Modules and vehicles responsible for propellant storage, supply, resupply and thruster 
operations are part of the Russian Segment. The FGB is the first element of the ISS, built in Russia under a U.S. 
contract. 

The authors have discussed the efforts undertaken to systematically identify the life limiting components and to 
devise and execute a comprehensive, multipronged test and analysis campaign for extending the service life of the 
FGB propulsion system. Based on a series of tests and analyses performed at various test facilities and laboratories 
involving multiple private and public sector organizations and academic institutions across Russia, it has been 
concluded that the service life of nearly all the components within the FGB propulsion system can be safely 
extended for nominal operations until 2028. A notable exception is the LTT, operational life for which has been 
currently limited to 2024, due to a very low probability failure mode. NASA considers this low likelihood risk to be 
small enough to continue nominal operations until 2028. 
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